Feeds

Huawei: 'trust us, we are being transparent'

Security chief advances charm offensive with 'our stuff is made all over' spiel

Using blade systems to cut costs and sharpen efficiencies

In an environment that's increasingly hostile to Chinese tech companies, Huawei has put forward its case for attitudes to be revised.

Speaking to the CeBIT Australia conference in Sydney, the company's global cyber security officer John Suffolk said there's little difference between Huawei and any other major vendor: its products come from a host of suppliers in a huge number of countries.

Seventy percent of the hardware found in Huawei's equipment comes from outside China, Suffolk claimed, and 32 percent of it comes from American suppliers. A similar tale can be told for software, he said, with contributions from around the world.

“We go, as all companies do, to where we can find the best researchers, the best talent around the world,” he said. “We go where we have talent, where the economic conditions are right.”

He described relocation of operations to follow services as “a core competency of every company”, something which underlines the need for any vendor to treat security as a global issue that flows all the way through every supply chain.

Noting that the world contains many, many places where any product could be compromised, he added that it's easier in general to bribe an insider than to launch a concerted and successful attack from the outside.

He also called on customers – particularly governments and large enterprises – to be far more activist in what they demand form vendors.

“If you, as governments or large enterprises, don't say to your vendors 'this is what good security looks like', don't expect the vendors to do anything about it,” he said.

He said that “highly variable” responses from vendors are an indication that they don't have good security procedures in place, but rather are “making it up as they go along”. Such are the opportunities to compromise a product, in a global supply chain, that no vendor can offer secure products “unless you have repeatable, standard processes.”

Transparency, he said, is vital to security and information assurance, and he claimed that Huawei is “the most audited company in the world … we can trace 96 percent of all our components, except non-tech things like cables and batteries”.

Customers should ask vendors “can you trace everything from a requirement through to code and back again?” Suffolk added.

“We welcome being audited, inspected, poked and prodded and probed,” he said. ®

Boost IT visibility and business value

More from The Register

next story
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Securing Web Applications Made Simple and Scalable
Learn how automated security testing can provide a simple and scalable way to protect your web applications.